Path: csiph.com!usenet.pasdenom.info!goblin2!goblin.stu.neva.ru!newsfeed.xs4all.nl!newsfeed4.news.xs4all.nl!xs4all!post.news.xs4all.nl!not-for-mail Return-Path: X-Original-To: python-list@python.org Delivered-To: python-list@mail.python.org X-Spam-Status: OK 0.013 X-Spam-Evidence: '*H*': 0.97; '*S*': 0.00; 'causing': 0.04; 'subject:Python': 0.06; '21,': 0.07; 'received:internal': 0.09; 'api': 0.11; 'python': 0.11; 'boundary.': 0.16; 'message- id:@webmail.messagingengine.com': 0.16; 'rarely': 0.16; 'received:10.202': 0.16; 'received:10.202.2': 0.16; 'received:10.202.2.44': 0.16; 'received:66.111': 0.16; 'received:66.111.4': 0.16; 'received:compute4.internal': 0.16; 'received:messagingengine.com': 0.16; 'weird': 0.16; 'wrote:': 0.18; 'entered': 0.20; 'command': 0.22; 'code,': 0.22; 'input': 0.22; 'error': 0.23; '(or': 0.24; 'header:In-Reply-To:1': 0.27; 'skip:( 20': 0.30; 'crash': 0.31; 'fri,': 0.33; 'could': 0.34; 'problem': 0.35; 'received:66': 0.35; 'except': 0.35; 'but': 0.35; 'there': 0.35; 'processed': 0.36; 'sequence': 0.36; 'similar': 0.36; 'received:10': 0.37; 'easily': 0.37; 'problems': 0.38; 'nov': 0.38; 'to:addr:python-list': 0.38; 'to:addr:python.org': 0.39; 'from:no real name:2**0': 0.61; 'header:Message-Id:1': 0.63; 'kind': 0.63; 'central': 0.64; 'more': 0.64; 'due': 0.66; '2014,': 0.84; 'circles': 0.84; 'refusing': 0.84; 'subject:Using': 0.84; 'silent': 0.95; 'serious': 0.97 DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=fastmail.us; h= message-id:x-sasl-enc:from:to:mime-version :content-transfer-encoding:content-type:subject:date:in-reply-to :references; s=mesmtp; bh=9eQXfGmg2jSscKqddUoOuiq1c8E=; b=n3GaTW 3HOhiGlCd+x3++AA2TxrDTJ68mtB+8xtY3P3F9YvVZ1CiaDjnTwQ+yQs+8hMS0rb juPQafoLF+g03t0K98mQVM50J/jrmyr/ktj0YsSJViuJZGLWlK9RN2Oua7Ls5WVW nj/hloXwpeO4ypt18UwsYMVFk6MfbbXbTbV4A= DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d= messagingengine.com; h=message-id:x-sasl-enc:from:to :mime-version:content-transfer-encoding:content-type:subject :date:in-reply-to:references; s=smtpout; bh=9eQXfGmg2jSscKqddUoO uiq1c8E=; b=SLsOHCFdzK5YTk7UujjZYXvzar5P2+1GEl0lgGW6pn85PskxbkNr Z+HVtRAquguSdUgijX21XXbjLNjlLT2YoEjWgljzkEIDgMTQ6kKew4ulPGKIhkA4 +L/iQvDUdmdPhZYBaGGh6ZAouQaD7fbB0oGHIBUH5G2o9sPMOGhOB0A= X-Sasl-Enc: uk/7BWCuqf0Ov+wilvNmeEPVMYThMP98CBZOpYkZdcEP 1416578063 From: random832@fastmail.us To: python-list@python.org MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Type: text/plain X-Mailer: MessagingEngine.com Webmail Interface - ajax-a419c8a0 Subject: Re: Using Python for date calculations Date: Fri, 21 Nov 2014 08:54:23 -0500 In-Reply-To: <0yEbw.852077$KL.733426@fx19.am4> References: <0yEbw.852077$KL.733426@fx19.am4> X-BeenThere: python-list@python.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: General discussion list for the Python programming language List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Newsgroups: comp.lang.python Message-ID: Lines: 18 NNTP-Posting-Host: 2001:888:2000:d::a6 X-Trace: 1416578070 news.xs4all.nl 2876 [2001:888:2000:d::a6]:44781 X-Complaints-To: abuse@xs4all.nl Xref: csiph.com comp.lang.python:81203 On Fri, Nov 21, 2014, at 05:33, alister wrote: > the problem with input is code-injection which is very similar to sql > injection (httpd://xkcd.com/327). > > the data entered by the user is processed as if it was python code, this > means the user could enter a command (or sequence of commands) that cause > serious problems to you computer including but not limited to:- Except standard input for interactive programs is rarely across a privilege boundary. The user can accomplish any of these far more easily by entering a command into their shell. (Well, more easily depending on which is better able to use the API for their central heating, but the others certainly). There are good reasons to avoid it (user is likely to be surprised by weird error messages, causing a crash due to a typo), but this kind of paranoia is the same as has people in some circles refusing to use strlcpy or fgets because they can cause silent truncation.